CLSA-2026-1787394930 Fix of 10 CVEs

SECURITY UPDATE: command injection in the tar plugin: tarVimuntar escaped the tarball name with shellescape without the special argument before running gunzip/gzip through :!, so characters that Vim expands in a :! command line such as % and survived in the name and let a crafted archive name run...